This transform supports two modes of operation. In XML mode the
data is encrypted XML and the result of decryption is a node set. In binary
mode the data is an encrypted octet sequence and the result of decryption is
an octet sequence. In both modes,
xenc:EncryptedData
elements in
the input node-set can be excluded from processing using
dcrpt:Except
elements.
dcrpt:Except
is defined
below via XML Schema [XML-Schema] and appears as
direct child elements of the
ds:Transform
element.

The REQUIRED
URI
attribute value of the
dcrpt:Except
element identifies
xenc:EncryptedData
elements within the input to the transform. The value MUST be a non-empty
same-document [URI] reference (i.e., a number sign '#'
character) followed by an XPointer expression [XPointer] as profiled by
The
Reference Processing Model [XML-Signature,
section 4.3.3.2].